Splunk Search
Highlighted

How to edit my regular expression to extract the last IP from my sample string using rex?

Explorer

Hey Guys,

I have the following output:

Server: abc-ij-qwerty88.asdf.xyz.com Address: 10.10.254.97 DNS request timed out. timeout was 2 seconds. DNS request timed out. timeout was 2 seconds. Name: google.com Address: 172.217.20.46

I'd like to extract the Last IP from the string.

I tried the following search with rex, but it returns a blank result:

.... | rex field=_raw "(?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$)" | table  ip_address

Where did I go wrong?

Your help is appreciated. Thanks!

0 Karma
Highlighted

Re: How to edit my regular expression to extract the last IP from my sample string using rex?

SplunkTrust
SplunkTrust

You were almost there. Use like this

.... | rex field=_raw "(?<ip_address>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$" | table  ip_address
0 Karma
Highlighted

Re: How to edit my regular expression to extract the last IP from my sample string using rex?

Explorer

I had tried this earlier, but it didn't work for me. Thanks for taking the time to help me!

0 Karma
Highlighted

Re: How to edit my regular expression to extract the last IP from my sample string using rex?

Motivator

you did not put the name of the tag ?<ip_address> which you are tabl(ing)

 .... | rex field=_raw "(?<ip_address>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$" | table  ip_address
0 Karma
Highlighted

Re: How to edit my regular expression to extract the last IP from my sample string using rex?

Explorer

Sorry, yeah I did use the tag but somehow forgot it when making this post. I tried your query but it produced the same blank results. The first answer solved my issue. Thanks!

0 Karma
Highlighted

Re: How to edit my regular expression to extract the last IP from my sample string using rex?

Legend

There's probably a LF at the end. Try this

... | rex "(?<ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})[\n\t\s]$" | ...

View solution in original post

Highlighted

Re: How to edit my regular expression to extract the last IP from my sample string using rex?

Explorer

Thank you! This worked for me. What did you mean by an "LF" at the end?

0 Karma
Highlighted

Re: How to edit my regular expression to extract the last IP from my sample string using rex?

Legend

Line feed. or line break

0 Karma
Highlighted

Re: How to edit my regular expression to extract the last IP from my sample string using rex?

Champion

just move the "$" outside the rex match.

  1. Rex match should be inside parentheses "(.....)",
  2. and to position the rex match, we can use this anchor "$", (which means at the end of line, ...opposite of "^" - beginning of the line)
 .... | rex field=_raw "(?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$" | table  ip_address
0 Karma
Highlighted

Re: How to edit my regular expression to extract the last IP from my sample string using rex?

Explorer

Thanks for your help! This didn't work, but the inclusion of [\n\t\s] at the end (1st answer) worked for me. Thanks again for your help.

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.